0 
iptables -A INPUT -p tcp -m multiport --dports 80,443,8080,8181 -m state --state NEW -m limit --limit 50/minute --limit-burst 200 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 80,443,8080,8181 -m state --state ESTABLISHED,RELATED -m limit --limit 50/second --limit-burst 50 -j ACCEPT

iptables -A PREROUTING -t nat -p tcp --dport 80 -j DNAT --to-destination :8080
iptables -A PREROUTING -t nat -p tcp --dport 443 -j DNAT --to-destination :8181
iptables -A FORWARD -p tcp -m multiport --dports 8080,8181 -j ACCEPT

I am trying to redirect traffic on 80 to 8080 and 443 to 8181. This was succesful by using preceding lines. Now I am trying to restrict access to 8080 and 8181 directly, though I am not sure how.

I know there are some questions concerning this issue, though I haven't found any solution. Despite the accepted answer in this question, I know this should be possible by just using iptables.

Any help would be appreciated.

Improve this question

3 Answers 3

Reset to default
1

The packets go through netfilter chains like this: PREROUTING->Routing Decision->INPUT if their destination address is your machine. DNAT which is applied in PREROUTING chain changes destination of the packets, it does not make them go both ways. So they get to the INPUT chain with dports 8080 or 8181, nothing goes to 80 and 443.

UPD: I finally see what you are trying to do. Try this rule
iptables -A INPUT -p tcp -m multiport --dports 8080,8181 -m conntrack ! --ctstate DNAT -j DROP

Improve this answer
4
  • You're right. With 8080 and 8181 open I will still receive the traffic from HTTP and HTTPS. Though does this mean I can possibly block this incoming on 8080 and 8181 during PREROUTING?
    – Menno
    Mar 27, 2013 at 21:32
  • Seems like iptables -A PREROUTING -t nat -p tcp --dport 8080 -j DNAT --to-destination :999 or some other closed port would do the trick, though I don't feel like this is a clean solution?
    – Menno
    Mar 27, 2013 at 21:39
  • 1
    @Aquillo I've updated the answer with a rule you might try.
    – pupkinsen
    Mar 28, 2013 at 4:06
  • Thanks for your help and time investment, I really appreciate this. I have used your rule though I used -I (so it preceeds the rules defined by me). This way 80 is accessible though 8080 is not.
    – Menno
    Mar 28, 2013 at 6:28
0

Just limit it based on the interface.

iptables -A INPUT -p tcp -i eth0 --dport 8080 -j DROP

Improve this answer
2
  • That would be the same as not using 8080 and 8181 in the first two rules (policy is DROP)? That was my first try, though my service was not available on 80 without 8080 open.
    – Menno
    Mar 27, 2013 at 18:58
  • I dont think so no, because your first two lines don't match on the interface, so removing 8080 and 8081 from it will drop the traffic from the localhost interface also (if you have a default drop policy).
    – Sirex
    Mar 27, 2013 at 20:53
0

Did you try this rules? i think the burst limit will not block traffick because the last line will accept it.

If you default policy is drop you can't restrict the acces even more. You only can permit some traffic -for example with your rules-.

Improve this answer
1
  • I know what you mean, but, isn't there perhaps a way to not having to open 8080 and 8181 at all?
    – Menno
    Mar 27, 2013 at 20:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .